Skills, Certifications, or Degrees: What Companies Demand for ...

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

Skills, Certifications, or Degrees: What Companies Demand for Entry-level Cybersecurity Jobs

Jim Marquardson jimarqua@nmu.edu College of Business Northern Michigan University Marquette, MI 49855, USA

Ahmed Elnoshokaty aelnosho@nmu.edu College of Business Northern Michigan University Marquette, MI 49855, USA

Abstract

People starting cybersecurity careers have three main avenues for achieving entry-level job qualifications: learning in-demand skills, earning industry certifications, and graduating with a college degree. Though people can pursue skills, certificates, and degrees together, financial and time constraints often make people focus their efforts to what they feel would help them most in their careers. Those seeking careers in information systems are reasonably asking themselves if the cost of a college degree is a worthwhile investment. In this paper, we analyze 11,938 entry-level job postings for cybersecurity jobs on to determine required and desired qualifications. The results show that 7,177 (60%) of entry-level cybersecurity jobs require a college degree in a related field. Of those, 2,851 (24% of jobs) prefer a graduate degree. 3,406 (29% of jobs) require a certification. Structured query language (SQL), testing, Java, Excel, Oracle, consulting, and database skills are listed in 16% of jobs. The most popular certifications are "Certified Information Systems Security Professional CISSP" (listed in 4.8% of jobs), "Information Technology Infrastructure Library ITIL" (listed in 3.9% of jobs), "Security+" (listed in 2.9% of jobs), "Project Management Professional PMP" (listed in 2.8% of jobs) and "Information Assurance Technical IAT" (listed in 2.4% of jobs). The selected snapshot data show that college degrees are required for 60% of jobs--evidence that college degrees are still in high demand for the field of cybersecurity. However, employers are also looking for certifications and skills.

Keywords: skills, certifications, college degrees, employment

1. INTRODUCTION

The total cost of graduation with a bachelor's degree from a four-year institution rose from $26,902 ($52,892 inflation adjusted) in 1989 to $104,480 in 2016 (Maldonado, 2018). The cost of education relative to earning power requires that many students incur significant debt to finance their educations. In 2019, borrowers in the United States carry $1.5 trillion in student loan debt (Friedman, 2019).

At the same time, education alternatives have emerged that offer instructional content at low or no cost. Sites like Khan Academy offer free courses, but mainly target K-12 education. Coursera offers a broader selection of courses with different ranges of complexity. For example, the Machine Learning course covers topics such as logistic regression, artificial neural networks, and linear algebra ("Machine Learning," n.d.). The Machine Learning course can be taken for free which allows the student to

?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 22

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

access all content except graded assignments, or a $79 fee can be paid which unlocks graded assignments and provides the option to earn a certificate. These massively scalable learning options are constantly adding new courses. Basically, as a potential alternative to the college degree, students can find cheap or free resources to learn skills that are sought in industry. A motivated student can learn online much of what is taught in a college classroom. But the same can be said of public libraries which have also failed to put universities out of business. The university seems to still add value beyond the mere collection and dissemination of ideas and information.

Society has traditionally placed value in college degrees beyond the immediate impact to the student on employment prospects. A major goal of universities is to educate a populace that can responsibly participate in the community discourse, produce leaders, and choose political representation. These high-minded goals in some way contrast the guidance of recent decades that told students they need a college degree so that they can land a good job and make good money. The Great Recession of the late 2000s and early 2010s found some college graduates unemployed or underemployed (Abel, Deitz, & Su, 2014), souring many graduates' opinions on the value of a college degree.

The remainder of this paper will shelve the benefits of a university education for society and for individual growth. Instead, the paper will address how skills, certificates, and degrees help people start their careers in information systems. Following is a literature review that compares skills, certificates and degrees. Then, an analysis of job postings is given to determine what the market demands.

2. LITERATURE REVIEW

In this section we describe how skills, certificates, and degrees help people advance their careers.

Skills Historically, companies in need of highly skilled labor have demanded college degrees. Recently, companies like Google, Apple, and Oracle have dropped the college degree requirement, instead choosing to emphasize work experience and specific skills (Hill, 2019). Skills are the degree to which employees can perform defined tasks. Employees might have skills in a particular programming language, a database platform, or another knowledge domain.

Skills definitely matter, but a narrow focus on specific skills tends to de-emphasize the need for employees to have well-rounded abilities. Some argue that "the skill-based approach is thus insufficient to identify the competence that will enable [an IT] manager to identify new IT opportunities and behave proactively in regard to IT" (Bassellier, Reich, & Benbasat, 2001, p. 163). Another fear is that as soon as the skill for which an employee was hired is no longer relevant, the employer may terminate employment rather than cross-train. Employers are increasingly reticent to invest in training the current workforce (Cappelli, 2014).

The field of information systems is vast, and skills can be developed in an ever-increasing array of topics. In a survey targeting the 20072008 hiring period for information systems jobs, fundamental accounting, finance, and marketing skills were expected, along with communication skills and information systems-specific skills such as software development, the systems development lifecycle, privacy, systems documentation, and problem identification (Janicki, Lenox, Logan, & Woratschek, 2008). An analysis of job postings in 2017 that required an information systems degree found that employers want skills such as teamwork, programming, written and oral communication, networking, database, systems analysis and design, and business (Burns, Gao, Sherman, & Klein, 2018). The results, though a decade apart, are largely consistent in their findings.

Certificates and Certification Certification can be described as either vendorneutral or vendor-specific (Randall & Zirkle, 2005). Certificates like the CompTIA Security+ assess competence in a fairly broad body of knowledge that does not focus on any one vendor or technology. The Security+ certificate is gained by taking a multiple-choice exam. The Cisco Certified Network Administrator (CCNA) certification tests networking knowledge and skills with an emphasis on Cisco's hardware and software. Though some knowledge transference to different domains is expected, additional study would be needed to perform well on other vendor platforms.

Some certifications target a single technology, knowledge domain, or course. Microsoft offers certification for its Office products. Amazon offers an AWS Certified Alexa Skills Builder exam that "validates a candidate's ability to build, test, and publish Amazon Alexa skills" ("AWS Certified Alexa Skill Builder - Specialty," n.d., para. 1). The skills proven by these certifications are less

?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 23

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

likely to transfer to technology in other information systems domains.

Many information technology certifications do not require college degrees, unlike other disciplines such as accounting and engineering (McKenzie, 2006). Some certifications, however, require work experience in a specific domain. For example, to become a Certified Information Systems Security Professional (CISSP), a candidate must have five years of work experience in information security positions ("CISSP Experience Requirements," n.d.).

There is some concern that common certifications fail to make job-seekers stand out because the number of people certified is so high (Gomillion, 2017). However, common certifications might indicate achievement of an in-demand skill. Certification in Microsoft Excel might be common, but many employers seek these skills (Formby, Medlin, & Ellington, 2017).

In an environment when technology changes rapidly, it is understandable why some might argue for achieving certification in areas that industry currently needs. The 2017 job survey mentioned previously showed that 20% of jobs required or preferred certification (Burns et al., 2018). Certification appears to be increasingly important, but college degrees continue to demonstrate value empirically as described in the next section.

Degrees College degree earners have increased lifetime earnings of a million dollars over their nondegree earning counterparts (Caruth, 2014). The time it takes a student to graduate has a large impact on the net present value of an education, largely due to delayed earnings (Lobo & BurkeSmalley, 2018). The desire to earn money right away is one reason why some choose to forego college, but the data suggests this is a losing strategy for maximizing lifetime earnings. In a survey of adults without degrees, the majority said that the expense of going back to get a degree was necessary to get ahead in their careers (Silliman & Schleifer, 2018).

The focus of study is as important as the decision to obtain a college degree. Vocational training in technical fields can improve earning power more than Bachelor of Arts degrees in liberal arts and humanities (Kim & Tamborini, 2019).

Despite current trends that emphasize hiring people for skills, people in advanced positions

frequently have one or more degrees. Job listings for cybersecurity architects list a graduate degree in 27% of postings, a bachelor's degree in 69% of postings, and only 4% with less than a bachelor's degree ("Cybersecurity Career Pathway," n.d.). It is difficult to predict if the increased focus on skills is a reaction to immediate skills shortages, or if it indicates a long-term trend.

Data suggests that a college degree can only help (and not hinder) long-term career objectives. Sadly, some students have embraced the clich? that "C's get degrees" and think that by merely graduating they will be granted a high-paying job in a rewarding career. This short-sighted view leads some to wonder why they fail to succeed in the job search.

Combinations A student can learn skills without ever obtaining a certificate or degree. While some employers care only about what employees can do, certificates and degrees are commonly used to filter applicants. Earning a certificate or degree (hopefully) proves that a student has learned skills. Some universities have embedded industry certification in degree programs (e.g., Haga, Moreno, & Segall, 2012; Jovanovic, Bentley, Stein, & Nikakis, 2006). It can be challenging to find textbooks that fully cover certification topics (Al-Rawi, Lansari, & Bouslama, 2005). A student can earn a certificate without a degree and vice versa.

Certifications and degrees "both have value for job seekers and the best solution seems to be some combination of both education and certification" (Gomillion, 2017, p. 72).

Proving Value to Prospective Employers Job-seekers must signal their qualifications to employers (Spence, 1973). College degrees and certifications are two objective ways to signal qualifications. Accreditation bodies ensure that universities follow best practices and provide some assurance of the value of a degree. Certification centers must also follow strict practices to ensure that certification exams are accurate assessments of candidate skills in part by proctoring exams and requiring photo identification. Skills-based assessments (such as coding interviews) can be used to validate the skills that should be evident by degrees or certificates, or when a candidate lacks any credentials.

In the next section, we seek to measure the benefit of skills, certifications and degrees by

?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 24

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

evaluating entry-level cybersecurity job postings.

3. METHODOLOGY

We created a crawler to collect data of entrylevel cybersecurity professional jobs from which is a popular website for IT jobs. The web crawler searched cybersecurity jobs at based on commonly used words for entry-level cybersecurity jobs like "Cybersecurity Analyst" or "Cybersecurity Architect." The crawler collected the 11,938 jobs that were available on on June 10, 2019. We collected labeled information for each job post like title, keywords (tags such as analysis, firewall, python, security, and TCP/IP), job location, and the job description.

The following preprocessing steps were applied to prepare the data set for analysis. First, all whitespace (such as new lines and extra spaces), punctuation, and HTML tags were removed. Second, the text was converted to lower case and stop words were removed. Stop words are basically a set of commonly used words in any language like "the," "into," "just," and "keep." By removing the words that are very commonly used in each language, we could focus only on the important words instead, and improve the accuracy of the text processing. Next, we applied lemmatization for all words to reduce inflectional word forms to linguistically valid lemmas.

To extract undergraduate or graduate degree requirements we searched for keywords like "bachelor degree," "master degree," "bsc," "msc," "mba," "doctorate," and "phd." To extract professional certification requirements, we looked up unigram, bi-grams, tri-grams, fourgrams, five-grams, and six-grams in the sentence where the keywords "certified," "certification," or "certificate" was listed and got the highest frequency of term occurrence to detect the certifications with the highest demand in the job market like "Information Technology Infrastructure Library ITIL," "Certified Information Security Manager CISM," and "Certified Information Systems Security Professional CISSP." To assess skill requirements, we looked for unigram, bi-grams, tri-grams, four-grams, five-grams, and sixgrams in the sentence in job keywords and job description and got the highest frequency of term occurrence to detect the skills with the highest demand in the job market like "Structured Query Language SQL," "Testing," and "SAP."

4. RESULTS

The results show that 60% of entry-level Cybersecurity jobs (7,177 jobs) require a college degree in a related field. 24% of jobs (2,851 jobs) prefer a graduate degree. 29% of jobs (3,406 jobs) prefer or require certifications. 6.6% of jobs preferred certifications without specifying certification names. Other jobs listed specific certifications as required or preferred. The most popular certifications are "Certified Information Systems Security Professional CISSP" (listed in 4.8% of jobs), "Information Technology Infrastructure Library ITIL" (listed in 3.9% of jobs), "Security +" (listed in 2.9% of jobs), "Project Management Professional PMP" (listed in 2.8% of jobs), and "Information Assurance Technical IAT" (listed in 2.4% of jobs).

Job Posting Element

Postings

College degree required

60%

Graduate degree preferred

24%

Prefer or require certification

29%

Table 1: Degrees and Certifications in

Entry-level Cybersecurity Job Postings

Certification

Postings

Certified Information Systems

4.8%

Security Professional (CISSP)

Information Technology

3.9%

Infrastructure Library (ITIL)

Security +

2.9%

Project Management Professional 2.8%

(PMP)

Information Assurance Technical 2.4%

(IAT)

Certified Information Security

1.4%

Manager (CISM)

Cisco Certified Network Associate 1.4%

(CCNA)

Certified Information Systems

1.4%

Auditor (CISA)

Table 2: Most Frequent Certifications

Requested in Entry-level Cybersecurity Job

Postings

"Certified Information Security Manager CISM," "Cisco Certified Network Associate CCNA," and "Certified Information Systems Auditor CISA" are each listed in 1.4% of jobs. "Global Information Assurance GIAC" is listed in 1% of jobs. "CISCO Certified Network Professional CCNP," "GIAC Certified Incident Handler GCIH," and "CompTIA Advanced Security Practitioner CASP" certifications are each listed in less than 1% of jobs. The listed certifications are either

?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 25

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

related to computer networks and security like "CISSP" and "Security +" or more business oriented like "PMP" and "ITIL".

As for the required or desired skills and qualifications, "Structured Query Language SQL" is listed in 6.3% of jobs, "testing" is listed in 5.4% of jobs. "Excel," "Java,, "Oracle," "consulting," "database," and "hardware" are each listed in 2-2.6% of jobs. "JavaScript", "python," "SAP," and "Linux" are each listed in 1.5-1.6% of jobs.

We studied the geographic location of the cybersecurity jobs and the majority of jobs are offered in the west and east coasts as well as Texas and some southern and Midwest states as shown in figure 1. In figure 1, we filtered out states with less than 100 jobs.

There is a high demand for college degree in jobs at all states, and on average 60% of the jobs requested or required a college degree. Figure 2 shows the states with the highest percentage of jobs requesting college degree requirements.

There is a demand for certifications in all states and on average 26% of the jobs requested or required a certification. Figure 3 shows the states with the highest percentage of jobs requesting certifications.

Figure 3. States with the Highest Percentage of Jobs Requesting Certification

Figure 1. States with High Supply of Entrylevel Cybersecurity Jobs

We analyzed the requested or required criteria of having a bachelor degree or certifications in each state with a high supply of cybersecurity jobs. We studied the percentage of cybersecurity jobs that requested or required a bachelor degree or certification to the total jobs per state as shown in Figure 2 and Figure 3 respectively.

Figure 2. States with the Highest Percentage of Jobs Requiring a Bachelor

Degree

5. DISCUSSION

More than half the entry-level cybersecurity jobs require job seekers to have a bachelor degree. Even in entry-level cybersecurity jobs, one in every four job postings has a graduate degree as a preference. Often, employers list jobs with required and desired certifications, but certification requirements are less frequent than college degree requirements. Our results show fewer requirements for college degrees than other sources. For example, the website reports high levels of a bachelor degree or higher requirement for entry-level cybersecurity jobs such as technicians and specialists (85%), analyst and investigators (93%), incident responder and analysts (94%), and IT auditors (98%) ("Cybersecurity Career Pathway," n.d.). The difference between our results may be in the distinction between what is preferred versus required.

Also, certification requirements include both business and technical certifications. The collected job posts show high demand for business certifications like "Information Technology Infrastructure Library ITIL" and "Project Management Professional PMP" as well

?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 26

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

as high demand for more technical certifications like "Certified Information Systems Security Professional CISSP", "Security +", and "Information Assurance Technical IAT." The CISSP is a popular certification in cybersecurity, and earning the certification requires at least five years of work experience in cybersecurity. We would expect the CISSP to also be a popular certification for mid-level and late-stage jobs.

As shown in figures 1, 2, and 3, the states with high supplies of cybersecurity jobs are not necessarily the states that require a higher percentage of jobs with college degree or certification requirements. States like Nebraska, Alabama, and Colorado do not have the most cybersecurity job postings but are among the states that more often require college degrees or certifications. Also, states like California have many jobs posted but have fewer requirements for degrees and certifications.

There are some limitations on the current analysis that should be noted. First, the search keywords were limited, so it is possible that some job postings or certifications were excluded from the analysis. Second, the current study does not predict the likelihood of a candidate being hired given a set of credentials. We can only assume that if two candidates meet the requirements, the candidates who meet more optional requirements (through either additional skills, certifications, or degrees) will be given preference. The current analysis cannot determine the extent to which an optional college degree will help a candidate gain employment when a degree is not required in the job posting. The extent to which optional qualifications aid in securing a job should be addressed in future research.

6. CONCLUSIONS

Although some might argue that achieving certifications in the industry is becoming more important than earning a college degree to land an entry-level job, this analysis provides empirical evidence that college degrees (bachelor and graduate degrees) are still in high demand for entry-level cybersecurity jobs. However, employers are augmenting requirements and desired qualifications for entry-level work with certifications, skills, and work experience. There is high demand for technical oriented certifications like "Security +" and "CISSP" as well as business-oriented certifications like "ITIL" and "PMP." Accordingly, we recommend that cybersecurity programs at colleges do not overlook the business aspects of

the program in favor of the technical aspects or vice versa and aim for balanced programs that cover both aspects. College degrees have more weight than certification requirements, which is reflected in the percentage of jobs with college degree requirements (60%) which is more than twice the percentage of jobs with certification requirements (29%).

As a future extension of this work, we are looking forward to studying the relationship between job requirements (such as college degree and certification requirements) and job benefits (such as salary, flexibility, and location). Also, we look forward to studying jobs in other related IT fields to complement our findings, since in this study we only collected cybersecurity related jobs.

9. REFERENCES

Abel, J. R., Deitz, R., & Su, Y. (2014). Are recent college graduates finding good jobs? Current Issues in Economics and Finance, 20(1).

Al-Rawi, A., Lansari, A., & Bouslama, F. (2005).

Integrating Sun Certification Objectives into

an IS Programming Course. Issues in

Informing Science & Information

Technology,

2,

247.



AWS Certified Alexa Skill Builder - Specialty.

(n.d.). Retrieved May 23, 2019, from

Amazon

Web

Services

website:



ed-alexa-skill-builder-specialty/

Bassellier, G., Reich, B. H., & Benbasat, I. (2001). Information Technology Competence of Business Managers: A Definition and Research Model. Journal of Management Information Systems, 17(4), 159?182.

Burns, T. J., Gao, Y., Sherman, C., & Klein, S. (2018). Do the Knowledge and Skills Required By Employers of Recent Graduates of Undergraduate Information Systems Programs Match the Current ACM/AIS Information Systems Curriculum Guidelines? Information Systems Education Journal, 16(5), 56.

Cappelli, P. (2014, September 5). What

Employers Really Want? Workers They Don't

Have to Train. Retrieved May 29, 2019, from

The

Washington

Post

website:



?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 27

Information Systems Education Journal (ISEDJ) ISSN: 1545-679X

18 (1) February 2020

leadership/wp/2014/09/05/what-employersreally-want-workers-they-dont-have-totrain/?noredirect=on&utm_term=.f9f549c3d 3bd

Caruth, G. (2014). Learning How to Learn: A Six Point Model for Increasing Student Engagement. Participatory Education Research, 1(2), 1?12.

CISSP Experience Requirements. (n.d.). Retrieved May 30, 2019, from ISC2 website: xperience-requirements

Cybersecurity Career Pathway. (n.d.). Retrieved May 23, 2019, from Cyberseek website:

Formby, S. K., Medlin, D., & Ellington, V. B. (2017). Microsoft Excel?: Is It an Important Job Skill for College Graduates? Information Systems Education Journal, 15(3), 55.

Friedman, Z. (2019, February 25). Student Loan Debt Statistics In 2019: A $1.5 Trillion Crisis. Retrieved May 23, 2019, from Forbes website: 2019/02/25/student-loan-debt-statistics2019/#2ae493db133f

Gomillion, D. L. (2017). The Role of IT Industry Certifications in an AACSB-Accredited Institution. Information Systems Education Journal, 15(1), 68.

Haga, W., Moreno, A., & Segall, M. (2012). Is Student Performance on the Information Systems Analyst Certification Exam Affected by Form of Delivery of Information Systems Coursework? Information Systems Education Journal, 10(5), 30.

Hill, C. (2019, April 17). You don't need a 4-year college degree for these high-paying jobs at Google, Apple, Netflix. Retrieved May 23, 2019, from MarketWatch website:

Janicki, T. N., Lenox, T., Logan, R., & Woratschek, C. R. (2008). Information systems/technology employer needs survey:

Analysis by curriculum topic. Information Systems Education Journal, 6(18), 1?16.

Jovanovic, R., Bentley, J., Stein, A., & Nikakis, C. (2006). Implementing industry certification in an IS curriculum: An Australian experience. Director, 7.

Kim, C., & Tamborini, C. R. (2019). Are They Still Worth It? The Long-Run Earnings Benefits of an Associate Degree, Vocational Diploma or Certificate, and Some College. RSF: The Russell Sage Foundation Journal of the Social Sciences, 5(3), 64?85.

Lobo, B. J., & Burke-Smalley, L. A. (2018). An

empirical investigation of the financial value

of a college degree. Education Economics,

26(1),

78?92.



32167

Machine Learning. (n.d.). Retrieved May 23,

2019,

from

Coursera

website:



learning

Maldonado, C. (2018, July 24). Price of College

Increasing Almost 8 Times Faster Than

Wages. Retrieved May 23, 2019, from

Forbes

website:



ado/2018/07/24/price-of-college-increasing-

almost-8-times-faster-than-

wages/#105e3ecf66c1+

McKenzie, W. B. (2006). Information Systems Curriculum Revision in a Hostile Environment: Declining Interest, Threats from Offshore, and Proprietary Certification. Director, 07.

Randall, M. H., & Zirkle, C. J. (2005).

Information technology student-based

certification in formal education settings:

Who benefits and what is needed. Journal of

Information

Technology

Education:

Research, 4(1), 287?306.

Silliman, R., & Schleifer, D. (2018). A Major Step: What Adults without Degrees Say about Going (Back) to College. Public Agenda.

Spence, M. (1973). Job Market Signaling. The

Quarterly Journal of Economics, 87(3), 355?

374.



?2020 ISCAP (Information Systems and Computing Academic Professionals) ;

Page 28

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download